7 - What Does Risk Culture Mean to a Corporation?

Summary

Business interest in the concept of ‘risk culture’ began in the early 2000s, coinciding with occasional corporate collapses (Enron, UBS, Barings etc) but also with strains in the financial system that foretold disaster. Interest in ‘rogue traders’ led to banks in particular asking whether they could suffer a fraud or other episode with serious, even catastrophic, financial and reputational consequences. This set a frame for thinking about ‘risk culture’ as something that should mainly try to identify dangerous individuals – the ‘bad apples’ syndrome. But the 2008 financial crisis triggered growing awareness of the need to understand the broader cultural and organisational systems that might make an entire entity and industry vulnerable to collapse. As the crisis unfolded, management consulting firms and powerful trade associations (notably the Institute of International Finance) began more systematically to explore and then advocate the importance of business cultures and how they not only defined propensities for risk taking, but also were potential sites for the widespread normalisation of deviance. Risk culture was analysed, adopted and promoted as an explanatory and diagnostic framework, in parallel and somewhat at odds with calls for far more robust levels of core capital in the banking industry.

As risk management systems were first adopted and then grew more complex, so questions began to be asked about the inevitable increase in costs. Did the value of formal risk management and the encouragement of well-behaved cultures in any way match the supposed benefits? What might be useful metrics in this complex space of organisational competition for resources and counterfactual justifications?

The author was in a privileged position as a journalist, consultant and practitioner, to observe and comment on some of the episodes and developments mentioned above. He shows how the value, real and imagined, of risk culture has differed temporally and contextually, and explores the consequences of rival meanings for different organisational structures. Second, he assesses the evidence as to whether those cases where there is a drive (whether unconscious or articulated) for ‘business value’ have tangible differences from cases where risk culture might be seen as more intrinsic and less value-oriented.